Kibana's visualize =>" missing" error

[ufkunkaraman]

it is token "missing" error from kibana's visualize if Number of characters is greater than ~400 (example)
How can this be solved? Any word limitation ?

[maojing0609]

me too

[stacey-gammon]

Sorry @ufkunkaraman, can you explain your issue a little more? What are the steps to reproduce it? What has > 400 characters? The visualization title?

[maojing0609]

it is token "missing" error from kibana's visualize if Number of characters is greater than ~400 (example)
How can this be solved? Any word limitation ?
hi,i have solved it

the reason is caused by ignore-above,which in my case ,set to the default value:256

https://www.elastic.co/guide/en/elasticsearch/reference/current/ignore-above.html
what shoud you do is config your logstash output template before indexing to elasticsearch
add flowing two lines in to logstash output

template => "/etc/logstash/elasticsearch-template-es6x-ignore_above.json"
template_overwrite => "true"

then config your template

{
  "template" : "mysql-slow*",
  "version" : 60001,
  "settings" : {
    "index.refresh_interval" : "5s"
  },
  "mappings" : {
    "_default_" : {
      "dynamic_templates" : [ {
        "message_field" : {
          "path_match" : "message",
          "match_mapping_type" : "string",
          "mapping" : {
            "type" : "text",
            "norms" : false
          }
        }
      }, {
        "string_fields" : {
          "match" : "*",
          "match_mapping_type" : "string",
          "mapping" : {
            "type" : "text", "norms" : false,
            "fields" : {
              "keyword" : { "type": "keyword", "ignore_above": 9999 }
            }
          }
        }
      } ],
      "properties" : {
        "@timestamp": { "type": "date"},
        "@version": { "type": "keyword"},
        "geoip"  : {
          "dynamic": true,
          "properties" : {
            "ip": { "type": "ip" },
            "location" : { "type" : "geo_point" },
            "latitude" : { "type" : "half_float" },
            "longitude" : { "type" : "half_float" }
          }
        }
      }
    }
  }

}

in my case,it works,hope help you.

[timroes]

I highly believe that also the initial reporter has the ignore_above issue. We should really come up with a better way to signal this (see #7324). I will close this, but if you figure out ignore_above isn't the cause of your issue, please feel free to leave a comment.